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, ^ . Abstract 

We establish a security proof of frequency-time coding quantum key distribution (FT-QKD) 

protocol by showing its connection to the squeezed state quantum key distribution protocol, which 

Q_i' has been proven to be unconditionally secure. We also extend the prepare-and-measure FT-QKD 

^ , protocol to an entanglement based FT-QKD protocol which is more appealing in practice. Further- 

ed 

^ I more, we propose a correlated frequency measurement scheme of entangled photon pair by using 

time resolving single photon detector. Simulation results show that the FT-QKD protocol can be 
^ . implemented with today's technology. 

Q^ . PACS numbers: 03.67.Dd, 03.65.Ud 
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I. INTRODUCTION 



One important practical application of quantum information is quantum key distribution 
(QKD), whose unconditional security is based on the fundamental laws of quantum mechan- 
ics Q, Ql- While QKD has been conducted through both optical fiber and free space, the 
availability of a worldwide fiber network suggests that single mode fiber (SMF) could be the 
best choice as the quantum channel for practical QKD systems. 

Two basic requirements on the quantum channel are low loss and weak decoherence. 
While the loss of standard SMF is relatively low, the decoherence introduced by a long 
fiber link depends on the coding scheme. Most practical QKD systems are based on either 
polarization coding or phase coding. Unfortunately, these two coding schemes suffer from 
polarization and phase instabilities in optical fiber induced by environmental noise. On the 
contrary, the frequency-time coding QKD (FT-QKD) scheme proposed in js] is intrinsically 
insensitive to the polarization and phase fluctuations. This suggests that the FT-QKD could 
be a more robust solution in practice. 

n 

In [3[, the security of the FT-QKD protocol was intuitively interpreted as a result of 
the energy-time uncertainty relation. In this paper, we provide a securityproof of the FT- 
QKD protocol by connecting it to the squeezed state QKD protocol 0, 5| whose security 
against the most general attack has been proven in j^. This connection is built upon the 
observation that the frequency and arrival time of a photon is connected to its momentum 
and spatial position. In quantum mechanics, the commutation relation between position 
and momentum operator is the same as that between the two quadratures of an oscillator. 
So, mathematically, the FT-QKD is equivalent to the squeezed state QKD, thus Gottesman- 
Preskill's security proof in jo] can be applied. We remark that one nice feature of Gottesman- 
Preskill's proof is that both the BB84 QKD protocol and the squeezed state QKD protocol 
(thus the FT-QKD protocol) are studied under the same scope. This allows us to apply 
many important results developed in the BB84 QKD, such as decoy state idea [7i] and the 
squash model of threshold single photon detector (SPD) jsl, into the FT-QKD protocol. 

We remark that single-photon continuous-variable QKD protocols exploring the spatial 
freedom of photons have also been investigated j^. However, it could be difficult to imple- 
ment those protocols over a long distance. 

Section II is a review of the prepare-and-measure FT-QKD protocol jsl . In Section 



2 



Ill, we show that mathematically, the FT-QKD is equivalent to the squeezed state QKD, 
therefore Gottesman-Preskill's security proof [6] can be applied. In Section IV, we propose 
an entanglement based FT-QKD protocol which is more appealing in practice. In Section 
V, we discuss the feasibility of implementing the FT-QKD with today's technology. We end 
this paper with a brief conclusion in Section VI. 



II. A BRIEF REVIEW OF THE PREPARE- AND-MEASURE FT-QKD PROTO- 
COL y 

Following the cryptographic convention, the two legitimate users in QKD are named as 
Alice and Bob, and the malicious eavesdropper is named as Eve. In the prepare-and-measure 
FT-QKD, Alice randomly chooses to use either "frequency-basis" or "time-basis" to encode 
her random bits. In the frequency-basis, one or more random bits can be encoded on the 
central frequency of a single-photon pulse which has a very small linewidth; In the time- 
basis, one or more random bits can be encoded on the time delay (defined relatively to a 
synchronization pulse) of a single-photon pulse which has a very small temporal duration. 
Upon receiving Alice's photon. Bob randomly chooses to measure either its frequency or 
its arrival time. After the quantum transmission stage, Alice and Bob compare their bases 
through a public authenticated channel and they only keep the results when they happen to 
use the same basis. Given the conditional variance of Bob's measurement results is below 
certain threshold, they can further generate secure key by performing error correction and 
privacy amplification. 

A schematic diagram of the prepare-and-measure FT-QKD protocol is shown in Fig.l. 
In Fig.l, Alice holds two transform-limited single photon sources: Si (for frequency coding) 
can generate single-photon pulses with a narrow spectral bandwidth (but a large temporal 
duration); 5*2 (for time coding) can generate single-photon pulses with a small temporal 
duration (but a broad spectral bandwidth). We assume that both Si and 5*2 have Gaussian 
spectra and their spectral bandwidths are a^^i and a^2, respectively. In the frequency-basis, 
Alice encodes her bits by randomly modulating the central frequency of 5*1. In the time-basis, 
Alice encodes her bits by randomly modulating the time delay of 5*2. A beam splitter {BSa 
in Fig.l) is employed to combine the outputs of 5*1 and 5*2 together. At Bob's side, passively 
determined by another beam splitter {BSb in Fig.l), he can either measure the arrival time 
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FIG. 1: Schematic diagram of the FT-QKD system: -narrowband frequency tunable single pho- 
ton source; 5'2-broadband single photon source with tunable time-delay; BSa/ BSB-heam splitters; 
r5PZ)-time-resolving single photon detector; DG-dispersive grating; yl-single photon detec- 
tor array. 

of the incoming photon with a time- resolving SPD, or its frequency (wavelength) with a 
dispersive element (such as a dispersive grating which is shown as DG in Fig.l) followed by 
a SPD array (SPDA). 

Given the frequency-modulation profile of Si matching with the spectrum of 5*2 and the 
time-delay-modulation profile of 5*2 matching with the temporal pulse shape of Si (as shown 
in Fig.2), it can be shown that the density matrix of a frequency-coding photon is identical 
to that of a time-coding photon, thus Eve cannot distinguish them from each other j^. 
The security of the FT-QKD protocol can be intuitively understood from the energy-time 
uncertainty relation which puts a constraint on Eve's ability to simultaneously determine 
both the frequency and the arrival time of a photon. Mathematically, Eve's time uncertainty 

( F) ( F) 

Ai and frequency uncertainty Aii (defined as root mean square (RMS) values) satisfy 
the following relation 



(1) 



On the other hand, Bob's measurement uncertainties are not bounded by equation (1) since 
he randomly measures either the arrival time or the frequency of each incoming photon but 
not both. Alice and Bob can establish an information advantage over Eve by post-selecting 
the cases when they happen to use the same bases, thus secure key distribution is possible. 
The FT-QKD protocol can be summarized as follows: 

I.Alice generates a binary random number a. If a = 0, she generates another random 
number b from the Gaussian distribution fi{b) = (vra^g) ""^^^^^Pf"!^ ~ ^o)"^ / '^^2]'^ then she 




FIG. 2: Illustration of the frequency (time) domain modulation profiles of Alice's single photon 
sources. Top Left: solid lines-the spectra of 5i corresponding to different frequency shifts; dashed 
line-the probabilistic distribution of the frequency-modulation profile which matches with the spec- 
trum of 5*2 shown in Bottom Left. Top Right: the pulse shape of Si in time domain. Bottom Left: 
the spectrum of 82- Bottom Right: solid lines-the pulse shapes of 5*2 corresponding to different 
time shifts; dashed line-the probabilistic distribution of the time- modulation profile which matches 
with the pulse shape of Si shown in Top Right. 

sets the central frequency of 5*1 to b and fires it. If a = 1, Alice generates a random number b 
from the Gaussian distribution /2(&) = (7r)^^/^(T^iexp[— a^j^fo^]; then she sets the time-delay 
of 5*2 to b and fires it. 

2. Upon receiving Alice's photon, Bob randomly chooses to measure either its arrival time 
or its frequency (wavelength). 

S.Alice and Bob repeat step 1 and step 2 many times. 

4. Through an authenticated classical channel, Alice and Bob post-select the cases when 
they use the same bases. After this step, Alice and Bob share a set of correlated Gaussian 
variables, which are called "key elements" . 

5. Alice and Bob convert the "key elements" into binary bit strings. 

6. Alice and Bob can estimate the maximum information acquired by Eve from the ob- 
served quantum bit error rate (QBER). If the QBER is below certain threshold value, they 
can future perform error correction and privacy amplification to distill out a secure key. 
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III. SECURITY OF THE FT-QKD PROTOCOL 



In this section, we provide a security proof of the FT-QKD protocol by connecting it to 
the squeezed state QKD protocol [5j. Section III. A is a brief review of the squeezed state 
QKD protocol jsl and Gottesman-Preskill's security proof |6|. In Section III.B, we apply 
Gottesman-Preskill's security proof to the FT-QKD implemented with perfect single photon 
sources and ideal photon-number-resolving SPDs. In Section III.C, we discuss the FT-QKD 
implemented with weak coherent sources (attenuated laser source) and practical thresholds 
SPDs. 



A. The squeezed state QKD and its security proof 

n 

In the prepare-and- measure squeezed state QKD protocol [5], Alice randomly prepares 
a single mode electromagnetic field either squeezed at amplitude quadrature (Xi) or phase 
quadrature {X2). For a Xi-squeezed state, its amplitude quadrature is well defined (while 
its phase quadrature has a large variance). Alice can randomly modulate the mean value of 
amplitude quadrature (Xi) to encode her bits; Similarly, for a X2-squeezed state, its phase 
quadrature is well defined (while its amplitude quadrature has a large variance). Alice can 
randomly modulate the mean value of phase quadrature (X2) to encode her bits. At Bob's 
end, he randomly chooses to measure either the amplitude quadrature or phase quadrature 
with a homodyne detector. After the quantum transmission stage, Alice and Bob compare 
their bases for each transmission and only keep the results when they happen to use the 
same basis ( "key elements" ) . If the (Xi)-modulation profile of the Xi-squeezed state matches 
with the distribution of Xi of the X2-squeezed state, and the (X2)-modulation profile of the 
X2-squeezed state matches with the distribution of X2 of the Xi-squeezed state, then Eve 
cannot tell which type of squeeze state Alice has prepared. 

Quantum mechanically, the two operators Xi and X2 are not commute with each other 
thus the uncertainty relation applies: Xi and X2 cannot both be defined to arbitrarily high 
accuracy for a given quantum state. This is the foundation of the security of the squeezed 
state protocol. Its security against the most general attack is given by Gottesman and 
Preskill in jsj. 

Instead of presenting its details, we simply remark that Gottesman-Preskill's security 
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proof employs quantum error-correcting codes that encode a finite-dimensional quantum 



system in the infinite-dimensional Hilbert space of an oscillator |10]. Note, in {g], a pair of 
dimensionless position and momentum operators q and p are used to encode information. 
The commutation relation between q and p is given by 

[q,p]=i (2) 

and the corresponding uncertainty relation is 

where Ag^™"'-* and Ap'"'"'*'' are defined as RMS values. 

To convert key elements into binary random numbers, the following distillation protocol 
is adopted [6j: Alice broadcasts her data modulo a/tt, i.e. m = mod{SA, v^)? Alice and Bob 
subtract m-y/vr from their data and correct the remainders to the nearest multiples of a/tt; 
They extract binary bit values based on whether the above integers are even or odd. 

The secure key rate R of the squeezed state QKD is given by [6| 

R=^[l^f{e)H,{e)-H,{e)]. (4) 

Here the factor 1/2 is due to the fact that half of the time, Alice and Bob use different bases, 
e is the observed QBER, f{x) is the bidirectional error correction efficiency, and H2{x) is 
the binary entropy function, which is given by 

H2{x) = -xlog2(x) - (1 - x) log2(l - x). (5) 

Given a perfect error correct code (/(x) = 1), Equation (4) shows that as long as the QBER 
is below 11%, secure key distribution ispossible. 

2A 

e < — expi-n/AA"^) (6) 

71 



The QBER in (4) is determined by [6] 



where A is a measure of the conditional variance of key elements, 

Proh{qA - qs) = l— exp[-{qA - qsf I A^] (7) 
V vrA^ 

Here we assume the conditional variance in q-basis (A^) is the same as that in p-basis (A^). 
In the case of A^ ^ A^, by slightly modifying the protocol and defining A^ = A^Ap, (6) 
is still applicable j6|. In Section III.B, we apply Gottesman-Preskill's security proof to the 
FT-QKD protocol. 



B. The FT-QKD based on perfect single photon sources and ideal photon-number- 
resolving SPDs 



We first study the case where Ahce holds perfect single photon sources and Bob has ideal 
photon number-resolving SPDs. 

Note that the energy time uncertainty relation, which has been used to intuitively under- 
stand the security of the FT-QKD protocol, is fundamentally different from the one applied 
to a pair of non-commuting operators, such as q and p. This is because in quantum me- 
chanics, conventionally, time is not treated as an operator. We remark that there have been 



great efforts on establishing a "time-of-arrival" operator in quantum mechanics Here, 
instead of touching this deep question in quantum physics, we simply take an operational in- 
terpretation of the time and frequency measurement. In practice, it is reasonable to assume 
that the speed of light in Alice and Bob's station is well defined and cannot be manipulated 
by Eve. By choosing a suitable time reference, the arrival time t and the frequency v (or 
wavelength A) of a single photon are related to its spatial position X and wave vector Kx 
(which is proportional to its momentum Px as Px = ^^x) by 

X = ct/n (8) 

2711/ 27m 
c/n A 

where n is the refractive index, h is the Planck constant and c is the speed of light in vacuum. 
Note that X and Kx satisfy the same commutation relation as p and q do 

[X,Kx]=t (10) 

So, mathematically, the FT-QKD is equivalent to the squeezed state QKD and Gottesman- 
Preskill's security proof in Q| can be applied. 

In practice, there are some technical issues to be resolved. First of all, in the squeezed 
state QKD, Bob uses a homodyne detector to detect Alice's signals. Regardless of the 
transmission loss, the homodyne detector always outputs an effective detection result. On 
the other hand, SPDs are employed in the FT-QKD. A SPD either detects nothing or an 
intact photon. Thus, in the FT-QKD, for each transmission. Bob has to inform Alice whether 
he detects a photon or not. Alice keeps her data only when one of Bob's SPDs clicks. To 
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take into account of this "post-selection" process, we can define an overall gain Qi as the 
ratio of the number of Bob's detection events to the number of signal pulses sent by Alice. 
Equation (4) is then replaced by 

R = - /(ei)i^2(ei) - H^ie,)]. (11) 

Here, we use subscript 1 to emphasis the fact that in the FT-QKD, only single-photon signals 
contribute to the secure key. Note (11) is the same as the secure key rate of the BB84 QKD 



protocol given in Shor-Preskill's security proof [12|. This is because the same approach has 
been adopted in the security proofs of [12] and [6|]. 

Secondly, in 0], it is assumed that the conditional variance defined in (7) is solely de- 
termined by the squeeze factor of the source while the contribution of detection system has 
been neglected. This is reasonable in the case of the squeezed state QKD because it is very 
difficult to prepare highly squeezed state in practice. However, in the FT-QKD, the un- 
certainty in quantum state preparation could be much less than that in the quantum state 
detection. For example, both a narrow-band laser pulse with a spectral linewidth much less 
than 1pm and an ultrashort laser pulse with a temporal duration less than Ips can be easily 
generated in practice. On the other hand, achieving a temporal resolution better than lOps 
or a spectral resolution better than 10pm in single photon detection are very challenge. So, 
in this paper, we assume that the conditional variance defined in (7) is determined by the 
finite temporal and spectral resolutions of the detection system. 



C. The FT-QKD protocol based on weak coherent sources and threshold SPDs 

The security analysis in Section III.B is based on the assumption that Alice has perfect 
single photon sources and Bob holds ideal photon number resolving SPDs. Unfortunately, 
these ideal devices are not available yet. A more practical approach is to implement the 
FT-QKD with weak coherent sources (heavily attenuated laser sources) and threshold SPDs 
(which can distinguish vacuum from non-empty pulses, but cannot resolve photon number). 
Fortunately, security proofs of the BB84 QKD protocol implemented with weak coherent 
source and threshold SPD have been developed. As we have remarked before, one nice 
feature of Gottesman-Preskill's proof [g^ is that both the BB84 QKD protocol and the 
squeezed state QKD protocol (thus the FT-QKD protocol) are studied under the same 



9 



scope, so many results developed in the BB84 QKD protocol can be applied to the FT-QKD 
protocol directly. Instead of presenting details of previous results, we simply remark that the 
decoy state idea j3] can be applied to a ^T-QKD protocol implemented with weak coherent 
sources and the squash model of SPD [Sj could be incorporated to resolve the security issue 
of using threshold SPDs. 

The FT-QKD protocol is interesting in principle. However the system shown in Fig.l is 
too complicated to be attractive in practice. In Section IV, we extend the FT-QKD to an 
entanglement based scheme. In Section V, we discuss the feasibility of implementing the 
FT-QKD with today's technology. 



IV. THE ENTANGLEMENT BASED FT-QKD PROTOCOL 

The prepare- and- measure FT-QKD protocol shown in Fig.l can be extended into an 
entanglement based QKD protocol, as shown in Fig. 3. A source generating energy-time 
entangled photon pairs can be placed either at Alice's station or between Alice and Bob. 
The energy and time of the two photons in the same pair are Einstein- Podolsky- Rosen (EPR) 



13| correlated. One photon from each EPR pair is sent to Alice and the other one is sent 
to Bob. Passively determined by a beam splitter, Alice (Bob) randomly measures either 
the arrival time or the frequency (wavelength) of each incoming photon. After the quantum 
transmission stage, Alice and Bob compare their measurement bases for each photon pair and 
only keep the results when they happen to use the same basis. The distillation protocol for 
the entanglement FT-QKD is the same as the one for the prepare-and-measure FT-QKD. 
The entanglement based FT-QKD is closely related to the squeezed state QKD protocol 
implemented with two mode Gaussian entangled squeezed state, whose security has also 



been proven in joj. 

In practice, the above energy-time entangled photon pairs can be generated through 
nonlinear optical processes, such as spontaneous parametric down-conversion (SPDC). As 
shown in Fig. 4, in this process, a pump photon spontaneously decays into a pair of daughter 
photons in a nonlinear crystal. The conservation of energy and momentum implies that the 
generated daughter photons are entangled in spectral and spatial domains. We assume that 
the pump pulse has a narrow spectral bandwidth of d^p and a relatively large temporal width 
of 5tp. We denote the central frequency of the pump pulse by up. The central frequency of 
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FIG. 3: Schematic diagram of the entanglement based FT-QKD system, (a) The EPR source is 
placed at Alice's station; (b) The EPR source is placed between Alice and Bob. EPR-energy-time 
entangled source; BS-beam splitter; TSPD-time-resolving single photon detector; DG-dispersive 
grating; SPDA-single photon detector array. 
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FIG. 4: Spontaneous parametric down-conversion (SPDC) process 

Alice (Bob)'s photon is i'a{'^b) and its spectral bandwidth is 61^^(61,3) ■ Furthermore, Alice 
(Bob)'s photon is generated at time tAits) with a temporal uncertainty of dtA^^tB)- 

Note the spectral bandwidths 5va and 5vb of the down-converted photons are determined 
by the phase matching condition and the actual experimental setup. The following condition 
can be satisfied in practice 

^uA = SuB > S^P (12) 

On the other hand, the temporal widths 6tA and 6tB of the down-converted photons are 
mainly determined by the temporal width 6tp of the pump photon 

5tA = StB = 5tp (13) 

So each individual photon of an EPR pair has both a broad spectral bandwidth and a 
large temporal width, as shown in Fig.4. This suggests that when Alice and Bob perform 
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time or frequency measurement, individually, they will observe large uncertainties in their 
measurement results. However, if Alice and Bob use the same basis, their measurement 
results are highly correlated, i.e. 

l^A + l^B ^ l^P (14) 
tA ^ tB (15) 

The uncertainty in (14) is determined by the line-width 6t,p of the pump laser, which 
can be less than lOMHz. This corresponds to a wavelength uncertainty in the order of 
0.1pm at telecom wavelength (~ 1550nm). The uncertainty in (15) depends on the spectral 
bandwidth 6^a of down-converted photon. In practice can be larger than lOOGHz, the 
corresponding time uncertainty in (15) is less than lOps. For the detection system, achieving 
a temporal resolution better than lOps or a spectral resolution better than 10pm at single 
photon level are very challenge. So we can assume that the conditional variance defined 
in (7) is fully determined by the finite temporal and spectral resolutions of the detection 
system. 

Comparing with the prepare-and-measure FT-QKD protocol based on the complicated 
Gaussian modulation scheme, the entanglement based FT-QKD explores the intrinsic 
energy-time correlation of an EPR pair. This greatly simplifies the whole QKD system. 
Furthermore, in the FT-QKD system shown in Fig. 3, no random numbers are needed dur- 
ing the quantum transmission stage. This mitigates the requirement for high speed random 



number generator 1^. The main technical challenge left is how to achieve high resolution 
spectral measurement at single photon level. In Section V, we will discuss two practical 
FT-QKD schemes. 

V. FEASIBILITY OF THE FT-QKD PROTOCOL 

A. The prepare-and-measure FD-QKD protocol with discrete modulation 

The FT-QKD protocol shown in Fig.l can be simplified by using discrete modulation 
scheme 1^, which is shown in Fig. 5. 



In this scheme [15[ , Alice randomly chooses to use either the frequency-basis or the time- 
basis to encode her random bit. In the frequency-basis, Alice uses frequency z/i (z/2) to 
encode bit "1" (bit "0"), while in the time-basis, she uses time delay ti (^2) to encode bit 
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FIG. 5: The basic scheme of the FT-QKD protocol with binary modulation 

"1" (bit "0"). At Bob's end, he randomly measures either the arrival time or the frequency 
(wavelength) of each incoming photon. After the quantum transmission stage, Alice and 
Bob compare their measurement bases for each transmission and only keep the results when 
they happen to use the same basis. If the QBER is low, they could further generate secure 
key by performing error correction and privacy amplification. 

Intuitively, to make this protocol secure, Alice's photons in different bases should at least 
partially overlap with each other in both time domain and spectral domain, so Eve cannot 
distinguish them faithfully. Furthermore, to apply the energy-time uncertainty relation to 
bound Eve's information, the condition of (z/2 — z^i)(t2 — ^i) < 1 may be required. This put 
some constraints on the minimal resolution of Bob's detection system. 

From implementation point of view, the FT-QKD with binary modulation is attractive. 
However, a security proof for this protocol is still missing. 

B. A practical entanglement based FT-QKD scheme 

Recall that one major technical challenge in the FT-QKD is how to achieve high resolution 
spectral measurement at single photon level. One intuitive idea is to use a highly dispersive 
element followed by a time resolving SPD. The dispersive element introduces a frequency- 
dependent time delay, thus information encoded in spectral domain will be transferred into 
time domain. Thus a time resolving SPD can be employed to decode the frequency of the 
incoming photon by measuring its arrival time. However, this idea cannot be applied directly. 
This is because each individual photon has an intrinsic time uncertainty (for example, in 
the order of ns) which cannot be distinguished from the frequency-dependent time delay. 
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FIG. 6: Schematic diagram of a practical entanglement based FT-QKD system: EPR-frequency- 
time entangled source; BS-beam splitter; F-spectral and temporal filters; Dyi-dispersive component 
with positive dispersion coefficient; D^-dispersive component with negative dispersion coefficient; 
TSPD-time-resolving single photon detector. 

Fortunately, the two photons in an EPR pair are entangled in both spectral and time domain, 
so the intrinsic time uncertainty of each individual photon can be canceled out. 

As shown in Fig.6, a dispersive element with a dispersion coefficient of (Db) is placed 
at Alice (Bob)'s side for frequency measurement. The dispersion coefficients of the two 
dispersive elements are chosen to satisfy Db = —Da- By using a suitable time reference, 
the detection time T4 of Alice's SPD in frequency-basis is given by 



TA = tA + Da^ua - t'o) 



(16) 



where vq is the central frequency of the spectral distribution of down-converted photon 
from the SPDC source. For the sake of simplicity, we assume that the two down-converted 
photons from each EPR pair have the same spectral distribution, so z/q = ^'po/2, where z/pg 
is the central frequency of the pump pulse. 

Similarly, Bob's detection time Tg in frequency-basis is given by 



Tb =tB + Db{vb - Vq) 



(17) 



Using equations (14-17) and the facts that Db = —Da, 1^0 = ^po/'2, we can see that Ta and 
Tb are highly correlated, i.e. T4 — Tg = with a small variance. 

We remark that the above frequency correlation measurement scheme is the same as the 
one proposed by J. D. Franson in nonlocal cancellation of dispersion 16|. 

As a side note, in (16-17) if we choose Db = Da, then we have Ta — Tb = Da{i^a — ^b) = 
DaI^ua ~ ^p)- Since Da and vp can be treated as constants, this provides a practical way 
to measure the spectrum of down-converted photons from a SPDC source. 
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In section III, we connected the arrival time and frequency of a single photon with its 
spatial position X and wave vector Kx- Similarly, the measurement defined in (16) can be 
treated as a measurement of a combination of X and Kx- In general, the above measurement 
can be represented hy W = aX + hKx-, where a and h are nonzero constants. Since the 
commutation relation between X and W is the same as the one between X and Kx (except 
a scale factor), Gottesman-Preskill's security proof is still applicable. 

Fig. 6 is a schematic diagram of the entanglement FT-QKD based on this new frequency 
measurement scheme. To evaluate its performance, equations (6) and (7) can be used to 
calculate the intrinsic QBER. As we have discussed above, the conditional variance (thus the 
intrinsic QBER) of the FT-QKD is mainly determined by the finite temporal and spectral 
resolutions of the detection system. Specifically, in the entanglement FT-QKD scheme shown 
in Fig. 6, given the dispersion coefficient of the dispersive elements, the intrinsic QBER is 
mainly determined by the time jitter of time resolving SPDs. For example, commercial 
dispersion compensation module based on fiber Bragg grating (FBG) technology can provide 



a dispersion coefficient as large as D\ = 7000ps/nm with a moderate loss of 5dB 171]. If 
the time resolution of the SPD is 50ps, then the spectral resolution will be about 7pm. 

In Fig. 6, both Alice's and Bob's detection system will make contributions to the mea- 
surement variance. If we assume noises from Alice and Bob's systems are independent and 
have identical distribution (i.i.d), then the total variance in (6) is given by 

A2 = 2AxAk (18) 

where A^ and A^ are conditional variances in time-basis and frequency-basis, respectively. 
From (8-9), Ax and Ak are determined by 

Ax = -A, (19) 

n 

27Tn , 27112 , , . 

We remark that variance A^ is defined as 1/e^, while in practice, time jitter of SPD {6t) 
is commonly defined in the fashion of full- width-half-amplitude (FWHA). For a Gaussian 
distribution, we have Aj = ^J^ 6t. Using (18-20), the conditional variance is given by 
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FIG. 7: Intrinsic QBER of the entanglement FT-QKD protocol. Here we assume A ~ 1550nm and 
Dx = lOOOps/nm. The QBER is about 5% for a time jitter of 70ps. The time jitter of a state- 



of-the-art superconducting nanowire single-photon detector (SNSPD) can be as small as AOps jlSl ]. 
and the resulting intrinsic QBER is about 0.05%. We also show the 11% security bound in the 
figure. 

Using (6) and (21), we calculate the intrinsic QBER as a function of the time resolution 
6t of the SPD. Here, we assume that the QKD system is operated at telecom wavelength 
(A ^ 1550nm) and the dispersion coefficient Dx = 7000ps/nm. The simulation results are 
show in Fig. 7: the QBER is about 5% for a time jitter of 70ps. The time jitter of a state- 
of-the-art superconducting nanowire SPD (SNSPD) can be as small as 40ps 18|, and the 
resulting QBER is about 0.05%. 

We remark the secure key rate given by (11) is derived based on perfect single photon 
sources (or in the case of entanglement based protocol, there should be no more than one 
EPR pair per pump pulse). However, in practice, multiple pairs could be generated by one 
pump pulse, so (11) cannot be applied directly. A similar problem has been studied in the 
entanglement based BB84 QKD protocol [19j, where the SPDC source has been identified 
as a basis-independent source thus the security analysis given in 20| can be applied. To 
apply the result in [l9| to the entanglement based FT-QKD system, an appropriate squash 
model of the threshold detector is needed. 

In practice, the effective detection window of the QKD system may be limited: in the 
time-basis, photons arriving outside of a certain time window may be treated as noise pho- 
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tons and be discarded; in the frequency-basis, photons outside of certain spectral range may 
not be detected. Eve may take advantage of this imperfection and introduce basis-dependent 
detection efficiency. Similar security issues have been studied in the BB84 QKD by, for ex- 
ample, time-shift attack 2l|. To close this potential loophole, spectral and temporal filters 
(represented by F in Fig. 6) can be placed at the entrance of the QKD system to make sure 
that the incoming photons are within the desired spectral and temporal range. 

VI. CONCLUSION 

One major advantage of the FT-QKD protocol is its robust against environmental noise: 
the frequency /time coding scheme is intrinsically insensitive to the polarization and phase 
fiuctuations. This could improve the stability of a practical QKD system dramatically. One 
may worry about the temporal broadening of a narrow laser pulse due to fiber dispersion. 
Fortunately, the dispersion of SMF at telecom wavelength has been thoroughly studied 



and various dispersion compensation technologies are available. For example, in [22|, after 
passing through a 50km fiber, a 460/s pulse was only slightly broaden to 470/s. This is 
orders lower than the time resolution of today's SPD. 

In this paper, we establish a security proof of the FT-QKD protocol by showing its 
connection to the squeezed state QKD. We also extend the prepare-and-measure FT-QKD 
protocol to an entanglement based FT-QKD protocol which is more appealing in practice. 
Furthermore, we propose a correlated frequency measurement scheme by using time resolving 
SPD. Simulation results show the feasibility of the FT-QKD protocol. 

As for future research directions, a rigorous security proof of the FT-QKD based on 
binary modulation scheme is highly desired. For the entanglement based FT-QKD, a suitable 
squash model for threshold SPDs is required. Furthermore, to fully take advantage of the 
continuous variable FT-QKD, a distillation protocol which can generate more than one bit 
from each transmission should be developed. 
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